| 1 | | Previous finding | Disposition at `4287f396` | |
| 2 | |---|---| |
| 3 | | R1-1 — Readiness without established database state | Remains resolved. | |
| 4 | | R1-2 — `off` waits behind publication | Remains resolved. | |
| 5 | | R1-3 — Unbounded console pointer reads | Remains resolved for reads. | |
| 6 | | R1-4 — Recovery generation deleted after failed synchronization | Remains resolved for the reported paths. | |
| 7 | | R1-5 — Rejected-upload test does not establish zero reads | Remains resolved. | |
| 8 | | R1-6 — Countries overflow ordering | Remains resolved. | |
| 9 | | R2-1 — Feed status writes bypass the read cap | **Resolved.** `DirStore.Put` now uses `os.Stat` for create-only writes and `hashFile` for replacement checks, preserving conditional-write semantics with bounded memory. The added regression test checks allocations against a 256 MiB existing object and verifies successful replacement. | |
| 10 | | R2-2 — Timed-out checks never persist failures | Remains resolved for download timeouts. | |
| 11 | | R2-3 — Unreadable feed status clears an alert | Remains resolved. | |
| 12 | | R2-4 — Unusable directory prevents “not loaded” alert | Remains resolved. | |
| 13 | | R2-5 — Published alert reasons never change while unhealthy | Remains resolved. | |
| 14 | | R3-1 — Console follower keeps serving an expired database | Remains resolved. | |
| 15 | | R3-2 — Transient status-read failure erases feed history | Remains resolved. | |
| 16 | | R4-1 — Unbounded bucket operations block startup or publication | Remains resolved for the reported operations. | |
| 17 | | R4-2 — Restart falsely clears a persisted GeoIP alert | Remains resolved. | |
| 18 | | R4-3 — Email delivery suppresses active reason changes | Remains resolved. | |
| 19 | | R4-4 — Region guesses carry another generation’s attribution | Remains resolved. | |
| 20 | | R5-1 — Unknown feed state suppresses confirmed expiry | Remains resolved. | |
| 21 | | R6-1 — Failed startup deletion leaves a disabled feed alert firing indefinitely | Remains resolved. | |
| 22 | | R7-1 — Unbounded feed edition metadata makes control records unreadable | Remains resolved. | |
| 23 | | R7-2 — Unchanged-edition checks leave the feed reported as “not run yet” | Remains resolved. | |
| 24 | | R8-1 — MMDB verification indefinitely holds the publish slot | Remains resolved for the reported traversal attacks. | |
| 25 | | R9-1 — Malformed MMDB metadata can crash the entire console | Remains resolved for the reported arithmetic panic. | |
| 26 | | R10-1 — Verifier child has no memory bound | Remains resolved on Linux for the reported allocation attack. | |
| 27 | | R10-2 — Retained recovery generations survive GeoLite2 expiry | Remains resolved for the reported synchronization failure. | |
| 28 | | R11-1 — Verified database crashes serving processes during lookup | Remains resolved for the reported stack-exhaustion path. | |
| 29 | | R12-1 — Underscore header spellings bypass stripping | Remains resolved. | |
| 30 | |
| 31 | Unchanged dispositions carry forward round 13’s conclusions; this review covers `6bdaba34..4287f396`. |
| 32 | |
| 33 | New findings: none confirmed. |
| 34 | |
| 35 | Validation: static review of both changed Go files and relevant callers. Scoped whitespace and formatting checks passed. Targeted Go tests could not start because the read-only sandbox refused build-directory creation; runtime tests and cross-compilation remain unverified. |
| 36 | |
| 37 | Verdict: merge-ready. |
amadan